The /auth/logout endpoint violates RFC 7230 4.1.2, which causes Vite to crash when proxying the API. #121

New issue

Open

opened 2026-02-05 13:01:28 +00:00 by kudyakovaa · 0 comments

kudyakovaa commented

2026-02-05 13:01:28 +00:00

(Migrated from git.csit.sgu.ru)

A sender MUST NOT generate a trailer that contains a field necessary for message framing (e.g., Transfer-Encoding and Content-Length), routing (e.g., Host), request modifiers (e.g., controls and conditionals in Section 5 of [RFC7231]), authentication (e.g., see [RFC7235] and [RFC6265]), response control data (e.g., see Section 7.1 of [RFC7231]), or determining how to process the payload (e.g., Content-Encoding, Content-Type, Content-Range, and Trailer).

You can reproduce this behavior using curl:

➜  ~ curl -i -X POST \
  -H "Content-Type: application/json" \
  -d '{"email": "SOME_EMAIL", "password": "SOME_PASSWORD"}' \
  -c cookie.txt \
  http://localhost:8034/api/v1/auth/login
HTTP/1.1 200 OK
Server-Timing: controller;dur=50
Set-Cookie: SESSION_ID=0aacf370-944f-485c-aaca-a38070c028ee; Path=/; Domain=localhost; Max-Age=604800; HttpOnly
Trailer: Server-Timing
Vary: Origin
X-Powered-By: Fuego
X-Request-Id: aa19d78e-9bb1-4e25-9da3-8953e8d28f69
Date: Thu, 05 Feb 2026 12:53:41 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked

{"sessionID":"0aacf370-944f-485c-aaca-a38070c028ee","createdAt":"2026-02-05T16:53:41.829732+04:00","expiresAt":"2026-02-12T16:53:41.829732+04:00","userID":"019c2b7c-20fc-75ad-9026-8e171b0676b7"}
Server-Timing: serialize;dur=0
➜  ~ curl -v -X POST \
  -b cookie.txt \
  http://localhost:8034/api/v1/auth/logout
* Host localhost:8034 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:8034...
* Connected to localhost (::1) port 8034
> POST /api/v1/auth/logout HTTP/1.1
> Host: localhost:8034
> User-Agent: curl/8.7.1
> Accept: */*
> Cookie: SESSION_ID=0aacf370-944f-485c-aaca-a38070c028ee
>
* Request completely sent off
< HTTP/1.1 204 No Content
< Server-Timing: controller;dur=0
* Replaced cookie SESSION_ID="" for domain localhost, path /, expire 1
< Set-Cookie: SESSION_ID=; Path=/; Domain=localhost; Max-Age=0; HttpOnly
< Trailer: Server-Timing
< Vary: Origin
< X-Powered-By: Fuego
< X-Request-Id: 88d7e4c0-2ec0-4195-b136-851f8c121b95
< Date: Thu, 05 Feb 2026 12:53:50 GMT
<
* Connection #0 to host localhost left intact

As observed, the backend adds a Trailer: Server-Timing header to an empty response.

It is also necessary to audit other endpoints that return empty responses.

> A sender MUST NOT generate a trailer that contains a field necessary for message framing (e.g., Transfer-Encoding and Content-Length), routing (e.g., Host), request modifiers (e.g., controls and conditionals in Section 5 of [RFC7231]), authentication (e.g., see [RFC7235] and [RFC6265]), response control data (e.g., see Section 7.1 of [RFC7231]), or determining how to process the payload (e.g., Content-Encoding, Content-Type, Content-Range, and Trailer). You can reproduce this behavior using curl: ```sh ➜ ~ curl -i -X POST \ -H "Content-Type: application/json" \ -d '{"email": "SOME_EMAIL", "password": "SOME_PASSWORD"}' \ -c cookie.txt \ http://localhost:8034/api/v1/auth/login HTTP/1.1 200 OK Server-Timing: controller;dur=50 Set-Cookie: SESSION_ID=0aacf370-944f-485c-aaca-a38070c028ee; Path=/; Domain=localhost; Max-Age=604800; HttpOnly Trailer: Server-Timing Vary: Origin X-Powered-By: Fuego X-Request-Id: aa19d78e-9bb1-4e25-9da3-8953e8d28f69 Date: Thu, 05 Feb 2026 12:53:41 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked {"sessionID":"0aacf370-944f-485c-aaca-a38070c028ee","createdAt":"2026-02-05T16:53:41.829732+04:00","expiresAt":"2026-02-12T16:53:41.829732+04:00","userID":"019c2b7c-20fc-75ad-9026-8e171b0676b7"} Server-Timing: serialize;dur=0 ➜ ~ curl -v -X POST \ -b cookie.txt \ http://localhost:8034/api/v1/auth/logout * Host localhost:8034 was resolved. * IPv6: ::1 * IPv4: 127.0.0.1 * Trying [::1]:8034... * Connected to localhost (::1) port 8034 > POST /api/v1/auth/logout HTTP/1.1 > Host: localhost:8034 > User-Agent: curl/8.7.1 > Accept: */* > Cookie: SESSION_ID=0aacf370-944f-485c-aaca-a38070c028ee > * Request completely sent off < HTTP/1.1 204 No Content < Server-Timing: controller;dur=0 * Replaced cookie SESSION_ID="" for domain localhost, path /, expire 1 < Set-Cookie: SESSION_ID=; Path=/; Domain=localhost; Max-Age=0; HttpOnly < Trailer: Server-Timing < Vary: Origin < X-Powered-By: Fuego < X-Request-Id: 88d7e4c0-2ec0-4195-b136-851f8c121b95 < Date: Thu, 05 Feb 2026 12:53:50 GMT < * Connection #0 to host localhost left intact ``` As observed, the backend adds a Trailer: Server-Timing header to an empty response. **It is also necessary to audit other endpoints that return empty responses.**